CVE-2009-4559

CVE-2009-4559 is a Cross-site Scripting (XSS) vulnerability in Drupal’s Submitted By module for the 6.x branch up to version 6.x-1.3. The issue allows remote authenticated users who have "administer content types" privileges to inject arbitrary script or HTML via the text entered in the "submitte...

PhotoDiary 1.3 Local File Inclusion

PhotoDiary 1.3 lng Local File Inclusion Vulnerability Discovered by cOndemned download: http://code.google.com/p/photodiary/ source of /admin/install.php lines 9 - 15: if isset$GET'lng' $LNG = $GET'lng'; 1 else $LNG = "ITA"; include "../common/language".$LNG.".php"; 2 proof of concept:...

PhotoDiary 1.3 (lng) LFI Vulnerability

No description provided by source. PhotoDiary 1.3 lng Local File Inclusion Vulnerability Discovered by cOndemned download: http://code.google.com/p/photodiary/ source of /admin/install.php lines 9 - 15: if isset$GET'lng' $LNG = $GET'lng'; 1 else $LNG = "ITA"; include...

PHPMyCart 1.3 - Cross-Site Scripting / Authentication Bypass

source: https://www.securityfocus.com/bid/37553/info Conkurent PHPMyCart is prone to a cross-site scripting vulnerability and an authentication-bypass vulnerability. An attacker may leverage these issues to gain unauthorized access to the affected application and execute arbitrary script code in...

PhotoDiary 1.3 - lng Local File Inclusion

PhotoDiary 1.3 - lng Local File Inclusion PhotoDiary 1.3 lng Local File Inclusion Vulnerability Discovered by cOndemned download: http://code.google.com/p/photodiary/ source of /admin/install.php lines 9 - 15: if isset$GET'lng' $LNG = $GET'lng'; 1 else $LNG = "ITA"; include...

PhotoDiary 1.3 - 'lng' Local File Inclusion

PhotoDiary 1.3 lng Local File Inclusion Vulnerability Discovered by cOndemned download: http://code.google.com/p/photodiary/ source of /admin/install.php lines 9 - 15: if isset$GET'lng' $LNG = $GET'lng'; 1 else $LNG = "ITA"; include "../common/language".$LNG.".php"; 2 proof of concept:...

PhotoDiary 1.3 (lng) LFI Vulnerability

Exploit for unknown platform in category web applications ====================================== PhotoDiary 1.3 lng LFI Vulnerability ====================================== PhotoDiary 1.3 lng Local File Inclusion Vulnerability Discovered by cOndemned download: http://code.google.com/p/photodiary/...

CVE-2009-4465

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in 1 templates/ including 2 templates/deluxe/admincp/...

Cross site scripting

Cross-site scripting XSS vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

Improper access control

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in 1 templates/ including 2 templates/deluxe/admincp/...

Deserialization of untrusted data

misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action...

CVE-2009-4467

CVE-2009-4467 affects DeluxeBB 1.3. The vulnerability arises in the valemail flow used during registration, where a pre-assigned USER_ID can be exploited to register accounts without a valid email address, with the USER_ID visible via a memberlist. The underlying issue is input/validation weaknes...

CVE-2009-4465

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in 1 templates/ including 2 templates/deluxe/admincp/...

CVE-2009-4466

DeluxeBB 1.3 is affected by CVE-2009-4466, where a crafted value for the page parameter in misc.php can cause an information disclosure by revealing the installation path in an error message. The issue may stem from how tools.php handles computations, potentially contributing to a denial of servi...

CVE-2009-4465

DeluxeBB 1.3 is affected by multiple vulnerabilities related to improper access control that expose sensitive files under web root. The issues allow remote attackers to retrieve user/configuration data, logs, and potentially gain administrative access by requesting unprotected paths such as templ...

DeluxeBB 1.3 - Multiple Vulnerabilities

Author: cp77fk4r | Empty0pagEShift+2gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang http://server/settings/ Cross Site Scripting...

Ultimate Uploader 1.3 - Arbitrary File Upload

Ultimate Uploader 1.3 - Arbitrary File Upload ========================================================================== Script Name : Ultimate Uploader 1.3 Language : php Vendor : http://www.element-it.com Author : Master Mind Home : www.shdowskill.com , www.vbspiders.com...

Ultimate Uploader 1.3 Remote File Upload Vulnerability

Exploit for unknown platform in category web applications ====================================================== Ultimate Uploader 1.3 Remote File Upload Vulnerability ====================================================== ==========================================================================...

Ultimate Uploader 1.3 Remote File Upload Vulnerability

No description provided by source. ========================================================================== Script Name : Ultimate Uploader 1.3 Language : php Vendor : http://www.element-it.com Author : Master Mind Home : www.shdowskill.com , www.vbspiders.com...

Ultimate Uploader 1.3 - Arbitrary File Upload

========================================================================== Script Name : Ultimate Uploader 1.3 Language : php Vendor : http://www.element-it.com Author : Master Mind Home : www.shdowskill.com , www.vbspiders.com ============================================================ Dork :...